[JaredP94]

Description

Expose the Go llama.cpp model hub in desktop and TUI, following #60, #61, #62 and #63. Resolve the requested verified-peer installed-list/delete parity by extending the existing peer inventory and authenticated remote operation, not by introducing a parallel peer API.

Scope

• Cache-error isolation follow-up: a llama.cpp cache read/validation failure returns HTTP 200 with healthy served/loaded inventory intact and the fixed, bounded downloadErrorsByEngine.llamacpp: "cache_unavailable" code (never filesystem details or absolute paths). Manual peers, scanner refreshes, broker discovery and both clients preserve this separate diagnostic. Only llama.cpp's installed-model pane says “Couldn't read llama.cpp's downloaded models”; recovery clears it. Desktop does not label an unreadable cache empty. Genuine whole-inventory failures keep their prior behavior.
• Reuse engine-manager GET /v1/models → pinned cluster mTLS → scanner/verified manual-peer enrichment → broker discovery snapshots → desktop bridge and TUI. Add bounded downloadedByEngine.llamacpp rows containing catalog ID/file-name, cache-relative file, size, digest and verified ownership, including while stopped. Keep served-model routing inventory separate. Previews and withdrawn proofs receive no cache inventory.
• Desktop projects installed peer rows and owned deletion. Running-engine Delete is disabled with a stop-engine reason; service refusal/error reasons remain visible. The downloaded-model bridge reads verified discovery for peers, never the local cache. Remote deletion is awaited through the existing engine:remote-delete-model → pinned-mTLS POST /v1/models/delete → engine-manager identity-checked delete_model path.
• TUI m lists installed peer cache files and d confirms owned deletion through the same remote method. Running/unowned guards remain; stale target/catalog responses cannot overwrite the current pane. Companion commits fix pending target state and cover desktop startup-picker edge cases.
• Retain publisher-grouped Go catalog, bounded public search, existing progress/cancel/retry tracking and revisioned startup-model/router-mode preview/apply. Catalog IDs remain names; descriptors are not names. No new polling loop.
• Startup-model pickers remain local, as with other engines. Desktop peer Settings arguments still accept a known installed catalog ID. This is not a claim of a peer startup picker.
• Component READMEs, getting-started, engine-lifecycle, terminal-interface, known-issues and release-readiness guidance updated. Runtime downloads are not bundled dependencies. CHANGELOG and root release claims are untouched.
• Version decision relative to v0.9.0: retain already sufficient unreleased minor bumps: engine-manager 1.5.0 (from 1.4.0), scanner/manual-nodes 1.4.0 (from 1.3.0), broker 2.6.0 (from 2.5.0), TUI 1.4.0 (from 1.3.0). All transitive shared/noderec binary importers were also checked against v0.9.0 and already have sufficient unreleased bumps; llamacpp-proxy is a new 1.0.0 component. No extra service/product/desktop release version bump.

Validation

The existing /tmp/pair-work/fix64-cache worktree on feat/llamacpp-desktop was used. Its own existing node_modules is a real directory, not a symlink. No cross-process suite was run locally.

• Desktop: typecheck, zero-warning lint, 966 unit tests / 98 files, dead-code, generated service-contract write/check, and licenses check pass (296 dependencies / 54 Go modules). Regeneration leaves the generated method listing unchanged.
• Go: fresh go test -race -c -o <tmpfile> . binaries for every test-bearing package in engine-manager, manual-nodes, scanner, broker, TUI and shared; run directly with -test.timeout=300s -test.count=1 under external QUIT timeouts. All pass. Darwin/Linux/Windows vet pass for all six modules; gofmt/diff checks are clean. SPDX: 1567 checked, zero missing.
• Observed red→green with only production fixes temporarily removed/restored: TestLlamaCacheFailurePreservesOtherEngineInventory returned HTTP 503 over pinned mTLS without the fix; TestPinnedManualPeerCacheErrorPreservesServedInventory kept the peer verified but lost both models and both engine-up flags. With the fix, the real HTTP producer keeps both served engines and returns the separate cache diagnostic.
• TestPinnedScannerCacheErrorPreservesServedInventory exercises that same real producer over pinned mTLS, scanner refresh publication and recovery. Manual-peer and scanner tests retain their distinct existing whole-inventory-outage behavior.
• Desktop projection/rendering and TestLlamaPeerCacheErrorIsEngineScoped were observed red without their production changes and green restored, preserving Ollama/LM Studio models and showing the message on llama.cpp only. A further red→green desktop regression prevents the false “No model/weight files downloaded” claim during a cache failure.
• Broker tests cover scanner projection, manual peer discovery + relay, error-only recovery publication and proof retirement. The retained shared/engineinventorytest fixture builds the real inventory producer against isolated fake engines; only test files import it, and it has SPDX headers.
• Retained the WIP's required inventory types, relay/cache/withdrawal hops, component docs and regressions; no unrelated runtime changes were found. Replaced its WIP history with logical signed-off service/client commits.
• Final head 6f2e04dd46b2b254e146d7af1ad4129fefcefbdf, CI run 42457822517, attempt 1: all six jobs passed. Downloaded cross-process-ubuntu-latest with gh run download into fresh empty /tmp/fix64-ci-linux.C8lJuX. python3 -I ~/.pair-review/scripts/noskip.py /tmp/fix64-ci-linux.C8lJuX/cross-process.jsonl reports 127 passes, zero failures/skips. An independent all-event scan of the same run's Linux artifact found zero skip/failure events and a successful package terminal event. No cross-process suite was run locally.

Risk

No real engine installation/model download, packaged GUI, live-peer inference or signing/notarization certification was performed. Installed inventory still has the existing discovery-refresh delay after peer mutations. Ownership is rechecked at deletion on the owning node, not trusted from UI metadata. Cache failures now leave healthy served inventory available with an engine-scoped diagnostic; genuine whole-inventory failures preserve the previous manual-peer/scanner behavior. Startup setting changes may restart an engine after confirmation. Packaged install/update/rollback, download/cancel/shutdown, inference/stop/restart and deletion smoke tests remain maintainer release gates. No independent review approval is claimed.

Checklist

• I have read the Contributing Guidelines.
• Every commit is signed off (git commit -s).
• New/existing service, desktop and TUI tests cover the change.
• Relevant component and release documentation is updated.
• I checked changed files/messages for private data and generated artifacts.
• Existing appropriate unreleased component versions are retained and explained above.
• Peer installed-cache list/delete gap resolved; local-only startup pickers documented.
• All six final-head CI jobs and Linux zero-skip artifact verified.